Event ID when User Account automatically... Expand / Collapse
Author
Message
Posted 5/12/2014 3:15:19 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 5/12/2014 2:55:10 AM
Posts: 1, Visits: 0
If a user is automatically unlocked due to GPO settings. Is the 4767 event triggered or is there another event to look for in that case?
Post #1342
Posted 6/14/2014 12:42:55 PM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 237, Visits: 0
Are you not seeing the unlock event? I think the event should be seen every time a user is unlocked.
Post #1343
Posted 6/17/2014 11:13:56 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 6/17/2014 11:09:46 AM
Posts: 1, Visits: 0
I don't believe this event exists. This is different from when an administrator unlocks an account that gets logged. When group policy or the local security policy has a duration enabled such that accounts are automatically unlocked after X minutes it doesn't appear that this generates any sort of event. Unfortunately, this would be quite helpful if Microsoft did log it.

Please let us know if anyone can find an audit policy to enable this logging as well as the event ID however I don't believe it exists.
Post #1346
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 3:02pm